CVE-2026-48924 Jenkins Bitbucket OAuth Plugin does not restrict the redirect URL after login
Attackers can exploit unrestricted redirect URLs in the Jenkins Bitbucket OAuth Plugin to conduct phishing attacks against users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-48924?
CVE-2026-48924 is a medium-severity vulnerability in Jenkins Bitbucket OAuth Plugin, published on 27 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Jenkins Bitbucket OAuth Plugin 0.17 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks.
Weakness: CWE-601
Which versions are affected by CVE-2026-48924?
2 open source packages ship an affected version, including org.jenkins-ci.plugins:bitbucket-oauth. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.plugins:bitbucket-oauth Maven | All versions | 0.18 |
org.jenkins-ci.plugins:bitbucket-oauth Maven | All versions | 0.18 |
Products include Jenkins Bitbucket Oauth.
How do I fix CVE-2026-48924?
Upgrade org.jenkins-ci.plugins:bitbucket-oauth to 0.18 or later.
Is CVE-2026-48924 being exploited?
There is no known exploitation of CVE-2026-48924 in the wild and no public exploit code.
Other vulnerabilities in Jenkins Bitbucket OAuth Plugin
Sources
Also known as GHSA-r8fj-rff6-f7h5.